PT-2009-1575 · Unknown · Discussion Forums 2K

~!Dok_Tor!~ · Publicado 2009-02-10 · Atualizado 2017-09-29 · CVE-2008-6100

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Discussion Forums 2k version 3.3

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This is possible when the magic quotes gpc setting is disabled. The vulnerabilities can be exploited through specific parameters in various PHP files, including the CatID parameter in "RSS1.php" and "RSS2.php" and the SubID parameter in "RSS5.php".

Recommendations For Discussion Forums 2k version 3.3, consider disabling the magic quotes gpc setting to prevent SQL injection attacks. Additionally, as a temporary workaround, restrict access to the vulnerable parameters CatID and SubID in the affected PHP files until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6100

Produtos afetados

Discussion Forums 2K

Referências · 4

• 🔥 http://securityfocus.com/bid/31518 · Exploit
• 🔥 https://exploit-db.com/exploits/6643 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6100 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45610 · Nota